AWS cli medium security documentation change
Summary
Added controlPlaneEgressMode parameter for cluster egress routing configuration
Security assessment
Introduces security control for cluster egress traffic routing (AWS_MANAGED vs CUSTOMER_ROUTED). Directly impacts network security posture by allowing isolation of control plane traffic. Customer responsibility warnings indicate security implications.
Diff
diff --git a/cli/latest/reference/eks/update-cluster-config.md b/cli/latest/reference/eks/update-cluster-config.md index 2458ebcd1..b2a95f9f8 100644 --- a//cli/latest/reference/eks/update-cluster-config.md +++ b//cli/latest/reference/eks/update-cluster-config.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -131 +131 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/eks-20 -> An object representing the VPC configuration to use for an Amazon EKS cluster. +> An object representing the VPC configuration to use for the cluster update. You can use this parameter to update the control plane egress mode, the subnets used by the cluster, the security groups, and the endpoint access settings. @@ -159,0 +160,14 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/eks-20 +> +> controlPlaneEgressMode -> (string) +> +>> Specifies the control plane egress routing mode for the cluster. If the cluster is set to `AWS_MANAGED` , Amazon EKS manages the egress path from the control plane and you don’t need to configure NAT gateways or other routing infrastructure for control plane traffic. If the cluster is set to `CUSTOMER_ROUTED` , you manage the egress path from the control plane in your VPC subnets. You are responsible for ensuring that the control plane can reach required endpoints such as webhook servers and OIDC providers. The default value is `AWS_MANAGED` . Once set to `CUSTOMER_ROUTED` , this setting cannot be changed back to `AWS_MANAGED` on the same cluster. +>> +>>> [Learn more about control plane egress routing in the *Amazon EKS User Guide* .](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-egress.html) +>> +>> Possible values: +>> +>> * `AWS_MANAGED` +>> * `CUSTOMER_ROUTED` +>> * `CUSTOMER_ISOLATED` +>> + @@ -164 +178 @@ Shorthand Syntax: - subnetIds=string,string,securityGroupIds=string,string,endpointPublicAccess=boolean,endpointPrivateAccess=boolean,publicAccessCidrs=string,string + subnetIds=string,string,securityGroupIds=string,string,endpointPublicAccess=boolean,endpointPrivateAccess=boolean,publicAccessCidrs=string,string,controlPlaneEgressMode=string @@ -175 +189,2 @@ JSON Syntax: - "publicAccessCidrs": ["string", ...] + "publicAccessCidrs": ["string", ...], + "controlPlaneEgressMode": "AWS_MANAGED"|"CUSTOMER_ROUTED"|"CUSTOMER_ISOLATED" @@ -847,0 +863 @@ update -> (structure) +>> * `ControlPlaneEgressUpdate` @@ -914,0 +931 @@ update -> (structure) +>>>> * `ControlPlaneEgressMode` @@ -990 +1007 @@ update -> (structure) - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) »